'What, how come?" you say? Recall you invoke "grep [h]ttpd", right? So, that's what displayed in ps. But grep interpret this regular expression differently. It means "I search for httpd", not "[h]ttpd". Everything enclosed in [] is something to search for, unless the "[" or "]" is escaped.